CVE-2026-89023 — ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to …
Published: 2026-09-14 · CVSS: 8.8 · CVSS 4.0
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, messages, verification tokens, and business data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7